Blacklight AI named in Wavestone's UK Cybersecurity Startup Radar 2026

Wavestone published its UK Cybersecurity Startup Radar 2026 on 20 July 2026, and Blacklight AI is named in it under AI-accelerated SOCs, alongside Darktrace.

The radar maps 225 UK cybersecurity startups, 144 of them newly identified this year, across 235 organisations in total once scale-ups and unicorns are counted. Inclusion is restricted to companies founded in the last seven years, with fewer than 35 employees, operating primarily in cybersecurity and earning less than half their revenue from consulting.

The UK radar forms part of Wavestone’s European Cybersecurity Startup Radar 2026, which analyses 729 companies across six markets: Belgium, France, Germany, Luxembourg, Switzerland and the United Kingdom.

The category is the story

Blacklight was named in Wavestone’s radar in 2025 as well, in the Detection and Response category, then the fastest growing group on the map. This year Wavestone created a new grouping for AI-accelerated security operations centres and placed us in it. Two consecutive years, two different categories.

That reclassification matters more than the listing. A category is only drawn when enough of the market has moved for the old one to stop describing what is happening. Wavestone’s own figure for the shift is stark: 62% of UK cybersecurity startups now embed AI, up from 30% in 2025. Within a single year, AI in security went from a differentiator a minority claimed to the default assumption, and the interesting question stopped being whether a platform uses AI.

What separates the companies in it

If almost two-thirds of the market embeds AI, “AI-powered” has stopped carrying information. The distinction worth drawing is between AI bolted onto an existing workflow and AI that changes who does the work.

An assistant that summarises an alert leaves the operating model intact: an analyst still reads the queue, still decides, still carries the backlog. An AI-accelerated SOC changes the model. Detection, investigation and the first triage decision run at machine speed, and the human is reserved for the judgement calls that carry real consequence, such as what a containment action will do to a live business process.

That is the distinction we have built toward, and it is the one the category now names.

Why third-party mapping is worth something

Analyst maps do not validate a product. Customers do. What an independent radar provides is different and still useful: a check that the way a company describes itself matches the way an outside party, with no commercial stake in the answer, classifies it after looking at the market as a whole.

Being moved into a category that did not previously exist, rather than staying in a familiar one, is the version of that check we would have asked for.

The number that matters is still the exposure window: how long an attacker operates before containment. Recognition is pleasant. That number is the job.

Read more about how the platform works, or what agentic AI actually changes in the SOC.